DynamicWEB: A Method for Reconnaissance Activity Profiling
Joel D. Scanlan, Jacky Hartnett, Raymond Williams · 2008
Port scan correlation aims to differentiate between benign and malicious scans. In this paper we will examine a new method of profiling port scan activity in an attempt to link different source IP addresses to being the same end user. A data mining approach DynamicWEB based upon the COBWEB conceptual clustering algorithm is shown along with some preliminary results of it functioning within the context of scan correlation.